Windows Installer CVE-2026-50490

Exploitation requires the attacker to already have local, authenticated access at a low privilege level (CVSS PR:L, AV:L) - this is a post-foothold privilege-escalation flaw, not a remote entry point. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local code execution is achieved the trigger against the Windows Installer service is reliable. The primary limiting factors are: the attacker must first obtain a local session on the target, exploitation cannot be performed over the network, and the target must be an unpatched Windows build below the fixed version for its release. The affected surface is the default Windows Installer component present on all listed Windows client and server editions, so no special non-default feature or configuration is required beyond having an unpatched system.

The signals are internally consistent and point to a real but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes local, low-complexity, low-privilege exploitation with no user interaction and total confidentiality/integrity/availability impact - a textbook local EoP. EPSS is low at 0.25% (16th percentile), and CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no' while confirming Technical Impact as 'total'. There is no KEV listing and no public exploit identified at time of analysis. These signals agree: high impact if exploited, but currently low probability of widespread opportunistic exploitation because a foothold on the host is required first and the flaw is not remotely reachable or automatable. This is best treated as a standard-priority patch item that becomes important in chained attacks (post-compromise privilege escalation), not a drop-everything remote threat.

An attacker who has already gained a foothold as a standard (non-admin) user - via phishing, a compromised app, or stolen credentials - runs a crafted program or MSI operation that triggers the use-after-free in Windows Installer, reclaiming the freed object to hijack execution while the service runs elevated. The result is code execution as SYSTEM, giving full control of the host for persistence and lateral movement. No public exploit is identified at time of analysis, and low attack complexity means a reliable exploit, if developed, would be straightforward to run locally.